CVE-2026-57236

Name of the Vulnerable Software and Affected Versions Nokogiri versions prior to 1.19.4

Description In the CRuby (libxml2) implementation, calling the Document#encoding= method with an invalid encoding, such as a non-string or a string containing a null byte, triggers an exception. This process occurs after the current encoding string of the document is freed without being replaced, leaving the document referencing freed memory. Consequently, subsequent calls to Document#encoding read invalid memory, which may lead to a segmentation fault (a crash occurring when a program attempts to access a memory location it is not allowed to access) or the leakage of freed bytes into a Ruby String.

Recommendations Update to version 1.19.4. As a temporary mitigation, avoid passing non-string values or strings containing null bytes to the Document#encoding= method.